Prerequisite for Mac
Code Block language bash brew install wget brew install gpg
Set environment variables for version & release candidate number.
Code Block language bash VERSION=0.12.0 RC=0
Download the release candidate
tarbellstarballs and open the directory for the corresponding release
candidate
# Download all files within a release candidatecandidate (e.g.
, https://dist.apache.org/repos/dist/dev/
incubator/-incubating1$
pinot-dev-listCode Block language bash mkdir
$
pinot-dev-listrc-test cd
$ VERSION=0.1.0
$ RC=0
$
/incubatorrc-test wget https://dist.apache.org/repos/dist/dev
incubating-/pinot/apache-pinot-
incubating-$VERSION-rc$RC/apache-pinot-
$VERSION-src.tar.gz
$
incubator/wget https://dist.apache.org/repos/dist/dev/
incubating-pinot/apache-pinot-
incubating-$VERSION-rc$RC/apache-pinot-
$VERSION-src.tar.gz.asc
$
incubator/wget https://dist.apache.org/repos/dist/dev/
incubating-pinot/apache-pinot-
-incubating$VERSION-rc$RC/apache-pinot
-$VERSION-src.tar.gz.sha512
$
incubator/wget https://dist.apache.org/repos/dist/dev/
incubating-pinot/apache-pinot-
-incubating$VERSION-rc$RC/apache-pinot
-$VERSION-bin.tar.gz
$
incubator/wget https://dist.apache.org/repos/dist/dev/
-incubatingpinot/apache-pinot
-incubating-$VERSION-rc$RC/apache-pinot
-$VERSION-bin.tar.gz.asc
$
incubator/wget https://dist.apache.org/repos/dist/dev/
-incubatingpinot/apache-pinot
-incubating-$VERSION-rc$RC/apache-pinot
-$VERSION-bin.tar.gz.sha512
- Verify bundle name, signature & SHA512 hashVerify if the bundle contains "incubating" in name (e.g. apache-pinot-incubating-x.x.x-src.tar.gz)
Import public keys from Pinot release managers (need to do
once)
$if gpg complains that there is no public key)
/incubatorCode Block language bash wget https://dist.apache.org/repos/dist/release
$/pinot/KEYS
gpg --import KEYS
Verify the signature (Note: You may see a WARNING that the key is not certified with a trusted signature. That is fine. See https://serverfault.com/questions/569911/how-to-verify-an-imported-gpg-key. Also, see https://gpgtools.tenderapp.com/kb/how-to/trusting-keys-and-why-this-signature-is-not-to-be-trusted#this-signature
$-is-not-to-be-trusted. In order not to see the warning message, you can edit the key in your local environment (see https://www.gnupg.org/gph/en/manual/x334.html)
incubating-$VERSIONCode Block language bash gpg --verify apache-pinot-
$${VERSION}-bin.tar.gz.asc
incubating-$VERSIONgpg --verify apache-pinot-
# Expected output${VERSION}-src.tar.gz.asc
-incubatinggpg: assuming signed data in 'apache-pinot
Mon-x.x.x-bin.tar.gz' gpg: Signature made
FebTue
11Aug
2310 13:
4047:
201908
PST2021
FD534854D542FD474278B85344BA03AD164D961BPDT gpg: using RSA key
6117BAEB7199AF89 gpg: Good signature from "Seunghyun Lee <snlee@apache.org>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: DDB6 EBD1 C9E6 ACB0 3DAF 3B44 6117 BAEB 7199 AF89 ### Please note that sometimes "KEYS" file shows the short key. The example is the following: -----END PGP PUBLIC KEY BLOCK----- pub 4096R/7199AF89 2021-05-10 uid Seunghyun Lee <snlee@apache.org> sig 3 7199AF89 2021-05-10 Seunghyun Lee <snlee@apache.org> sub 4096R/F306596D 2021-05-10 sig 7199AF89 2021-05-10 Seunghyun Lee <snlee@apache.org> -----BEGIN PGP PUBLIC KEY BLOCK----- # KEYS file indicates "7199AF89" as the key while the pgp verify command shows the full key "6117BAEB7199AF89" # In this case, please do check the last 8 digits and see if they do match.
Verify hashes
ultimate]Code Block language bash
Verify hashes
$# Compare the output with *.tar.gz.sha512 file
-incubating-$VERSIONshasum -a 512 apache-pinot
$-${VERSION}-bin.tar.gz cat apache-pinot-${VERSION}-bin.tar.gz.sha512
-incubating-$VERSIONshasum -a 512 apache-pinot
-${VERSION}-src.tar.gz cat apache-pinot-${VERSION}-src.tar.gz.sha512
Open a directory for the corresponding release candidate and untar the
tarbell
$ cd apache-pinot-incubating-$VERSION-rc$RC $tarball.
incubating-$VERSION-Code Block language bash tar -xzvf apache-pinot-
${VERSION}-src.tar.gz
$
incubating-$VERSIONtar -xzvf apache-pinot-
${VERSION}-bin.tar.gz
- Verify git commit hash & tag
- Check
Checking if the git commit hash provided in voting mail matches with the commit hash from the actual tag
Check& checking if the source release matches with the git tag
.
$
$VERSION-rc$RCCode Block language bash git clone -b release-
incubator-${VERSION}-rc${RC} --single-branch --depth 1 https://github.com/apache/
$pinot.git pinot-git-src
cd pinot-git-src
$ git log# Check git commit hash given here against the one given in the voting mail
$git log cd ..
$
incubating-$VERSIONdiff -r apache-pinot-
${VERSION}-src pinot-git-src
# Expected output is to only include lines starting with "Only in pinot-git-src..."
# Only in pinot-git-src: .codecov_bash
# Only in pinot-git-src: .codecov.yml
# ...
- Check
- Verify DISCLAIMER, LICENSE, and NOTICE files are present in the extracted bundle.
Verify if the source distribution can compile
Warning You must build and run with JDK 11+
and tests) $Code Block language bash cd apache-pinot-${VERSION}-src # Build Pinot (This will run license check, compilation,
$but not tests. Running tests will take a few hours, you can enable it by removing -DskipTests option) mvn clean install -Pbin-dist -DskipTests -T1C # Run Quick Demo
-incubating-$VERSIONcd pinot-distribution/target/apache-pinot
$-${VERSION}-bin/apache-pinot-${VERSION}-bin
offlinebin/quick-start-
batch.sh # At this point, open a web browser and go to http://localhost:9000/query and try to run some queries
Verify if the binary distribution
areis working well with the Quick Demo
$Code Block language bash # Run Quick Demo
incubating-$VERSION-bin/apache-pinot-incubating-$VERSION-bin $cd apache-pinot-
offline${VERSION}-bin bin/quick-start-
batch.sh # At this point, open a web browser and go to http://localhost:9000/query and try to run some queries
Checklist
...
- Verify signature, hash
- Verify if the released source matches with the provided git tag & hash
- Verify if DISCLAIMER, LICENSE, NOTICE files are present
- Check if the source distribution can compile (Do not skip the tests)
- Run quick demo from both source and binary distributions
...